7c3c41d8da242f6ae707daaf842c0c0afb4ff541e3b009c62e51bc7d93eca86b

Analysis

max time kernel
126s
max time network
127s
platform
windows10_x64
resource
win10v200722
submitted
10/09/2020, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup_install.bin.exe
Size 2.4MB
Sample200910-fxqqmg5dnn
SHA256 7c3c41d8da242f6ae707daaf842c0c0afb4ff541e3b009c62e51bc7d93eca86b
MD5 5f675b2769cc5189ab4dfc06a13cff46
SHA1 9a0a5feab69ba35795bc87913a031d62e4d3d20e
SHA512 32c94293693ca7c7e36bc17f1b2e330c92af242a674aa8a165115d062f71b1553ba278f1281bdba5bb6e044bc832349e20ceb3ba90d84b3f2ab4677c3ce20177
MD5 SHA1 SHA512

Score

9^/10

spyware discovery evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Blacklisted process makes network request 4 IoCs

flow	pid	Process
16	3008	WScript.exe
18	3008	WScript.exe
20	3008	WScript.exe
22	3008	WScript.exe

Executes dropped EXE 4 IoCs

pid	Process
2984	ahwxqhj.exe
996	tokrtysmulpo.exe
504	sbqshguhuqp.exe
2412	SmartClock.exe

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	tokrtysmulpo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sbqshguhuqp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	sbqshguhuqp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SmartClock.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SmartClock.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ahwxqhj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ahwxqhj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	tokrtysmulpo.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SmartClock.lnk	sbqshguhuqp.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Wine	ahwxqhj.exe
Key opened	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Wine	tokrtysmulpo.exe
Key opened	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Wine	sbqshguhuqp.exe
Key opened	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Wine	SmartClock.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
32	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
2984	ahwxqhj.exe
996	tokrtysmulpo.exe
504	sbqshguhuqp.exe
2412	SmartClock.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup_install.bin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup_install.bin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ahwxqhj.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ahwxqhj.exe

Delays execution with timeout.exe 3 IoCs

evasion

pid	Process
1764	timeout.exe
2368	timeout.exe
3584	timeout.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 150cef246387d601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2412	SmartClock.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2984	ahwxqhj.exe
2984	ahwxqhj.exe
996	tokrtysmulpo.exe
996	tokrtysmulpo.exe
504	sbqshguhuqp.exe
504	sbqshguhuqp.exe
2412	SmartClock.exe
2412	SmartClock.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3864	svchost.exe
Token: SeCreatePagefilePrivilege	3864	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2984	ahwxqhj.exe
2984	ahwxqhj.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 2408	3888	setup_install.bin.exe	75
PID 3888 wrote to memory of 2408	3888	setup_install.bin.exe	75
PID 3888 wrote to memory of 2408	3888	setup_install.bin.exe	75
PID 2408 wrote to memory of 3008	2408	cmd.exe	77
PID 2408 wrote to memory of 3008	2408	cmd.exe	77
PID 2408 wrote to memory of 3008	2408	cmd.exe	77
PID 3888 wrote to memory of 3744	3888	setup_install.bin.exe	78
PID 3888 wrote to memory of 3744	3888	setup_install.bin.exe	78
PID 3888 wrote to memory of 3744	3888	setup_install.bin.exe	78
PID 3744 wrote to memory of 2984	3744	cmd.exe	80
PID 3744 wrote to memory of 2984	3744	cmd.exe	80
PID 3744 wrote to memory of 2984	3744	cmd.exe	80
PID 2984 wrote to memory of 2920	2984	ahwxqhj.exe	81
PID 2984 wrote to memory of 2920	2984	ahwxqhj.exe	81
PID 2984 wrote to memory of 2920	2984	ahwxqhj.exe	81
PID 2920 wrote to memory of 1764	2920	cmd.exe	83
PID 2920 wrote to memory of 1764	2920	cmd.exe	83
PID 2920 wrote to memory of 1764	2920	cmd.exe	83
PID 3888 wrote to memory of 1540	3888	setup_install.bin.exe	84
PID 3888 wrote to memory of 1540	3888	setup_install.bin.exe	84
PID 3888 wrote to memory of 1540	3888	setup_install.bin.exe	84
PID 1540 wrote to memory of 996	1540	cmd.exe	86
PID 1540 wrote to memory of 996	1540	cmd.exe	86
PID 1540 wrote to memory of 996	1540	cmd.exe	86
PID 3888 wrote to memory of 780	3888	setup_install.bin.exe	87
PID 3888 wrote to memory of 780	3888	setup_install.bin.exe	87
PID 3888 wrote to memory of 780	3888	setup_install.bin.exe	87
PID 780 wrote to memory of 504	780	cmd.exe	89
PID 780 wrote to memory of 504	780	cmd.exe	89
PID 780 wrote to memory of 504	780	cmd.exe	89
PID 504 wrote to memory of 2412	504	sbqshguhuqp.exe	90
PID 504 wrote to memory of 2412	504	sbqshguhuqp.exe	90
PID 504 wrote to memory of 2412	504	sbqshguhuqp.exe	90
PID 996 wrote to memory of 1264	996	tokrtysmulpo.exe	91
PID 996 wrote to memory of 1264	996	tokrtysmulpo.exe	91
PID 996 wrote to memory of 1264	996	tokrtysmulpo.exe	91
PID 1264 wrote to memory of 2368	1264	cmd.exe	94
PID 1264 wrote to memory of 2368	1264	cmd.exe	94
PID 1264 wrote to memory of 2368	1264	cmd.exe	94
PID 996 wrote to memory of 2372	996	tokrtysmulpo.exe	95
PID 996 wrote to memory of 2372	996	tokrtysmulpo.exe	95
PID 996 wrote to memory of 2372	996	tokrtysmulpo.exe	95
PID 2372 wrote to memory of 3584	2372	cmd.exe	97
PID 2372 wrote to memory of 3584	2372	cmd.exe	97
PID 2372 wrote to memory of 3584	2372	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\setup_install.bin.exe
"C:\Users\Admin\AppData\Local\Temp\setup_install.bin.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\wsitbeeaq.vbs"
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wsitbeeaq.vbs"
    3⤵
    - Blacklisted process makes network request
    PID:3008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\ahwxqhj.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3744
- - C:\Users\Admin\AppData\Local\Temp\ahwxqhj.exe
    "C:\Users\Admin\AppData\Local\Temp\ahwxqhj.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2984
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\TORd5CtNfY1e & timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\ahwxqhj.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:1764
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\tokrtysmulpo.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\tokrtysmulpo.exe
    "C:\Users\Admin\AppData\Local\Temp\tokrtysmulpo.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\ovwbbguh & timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\tokrtysmulpo.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:2368
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c rd /s /q C:\ProgramData\ovwbbguh & timeout 2 & del /f /q "C:\Users\Admin\AppData\Local\Temp\tokrtysmulpo.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2372
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        5⤵
        Delays execution with timeout.exe
        
        PID:3584
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\AppData\Local\Temp\sbqshguhuqp.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Users\Admin\AppData\Local\Temp\sbqshguhuqp.exe
    "C:\Users\Admin\AppData\Local\Temp\sbqshguhuqp.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Drops startup file
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:504
  - - C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe
      "C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      PID:2412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/504-42-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/504-41-0x0000000005320000-0x0000000005321000-memory.dmp

Download

memory/504-40-0x0000000004B20000-0x0000000004B21000-memory.dmp

Download

memory/996-38-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/996-39-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Download

memory/2412-46-0x0000000005460000-0x0000000005461000-memory.dmp

Download

memory/2412-47-0x0000000005C60000-0x0000000005C61000-memory.dmp

Download

memory/2984-8-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Download

memory/2984-9-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download

memory/2984-10-0x00000000057B0000-0x00000000057B1000-memory.dmp

Download